CVE-2024-58354

cal.com (calcom repository, later renamed cal.diy) is affected by a repository takeover vulnerability in its GitHub Actions workflows. The workflow pr.yml uses the pull_request_target trigger with the repository's default write permissions and passes them down to check-types.yml. check-types.yml then performs a 'dangerous' checkout of the attacker-submitted pull request code (via the dangerous-git-checkout action) and subsequently executes it (through yarn install and package.json scripts). An attacker can open a pull request whose code runs arbitrary commands with the repository's write-scoped GITHUB_TOKEN, allowing them to push commits, merge or mutate pull requests, add or delete comments, and delete or force-push branches, thereby compromising the repository. The main branch is affected; no patched version is available.

• CWE-77

• https://github.com/calcom/cal.diy/commit/9aa60fae41a6b6b101c86bf430754b439f440871
• https://github.com/calcom/cal.diy/security/advisories/GHSA-p3f6-52gv-cj7m
• https://www.vulncheck.com/advisories/cal-com-repository-takeover-via-pull-request-target-workflow
• https://github.com/calcom/cal.diy/security/advisories/GHSA-p3f6-52gv-cj7m

Published

Jul 23, 2026

Last Modified

Jul 30, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-58349WordPress Theme Travelscape 1.0.3 contains an arbitrary file…9.8
• CVE-2024-5835Heap buffer overflow in Tab Groups in Google Chrome prior to…8.8
• CVE-2024-58350Ghidra before 11.2 contains a use after free vulnerability i…4
• CVE-2024-58351Flowise before 2.1.4 allows configuration to be injected int…9.8
• CVE-2024-58352Landray OA contains an unauthenticated HQL injection vulnera…8.7
• CVE-2024-58353Cal.com (repository calcom/cal.diy) in versions <= 4.7.15 is…9.3
• CVE-2024-58355Cal.com (calcom/cal.diy) versions through 4.7.15 contain a s…9.3
• CVE-2024-58356SurrealDB before 2.1.4 silently fails to overwrite table def…6.3
• CVE-2024-58357SurrealDB versions before 2.1.0 contain an uncaught exceptio…7.1
• CVE-2024-58358SurrealDB versions before 2.1.0 contain a denial of service …6.9
• CVE-2024-58359SurrealDB versions before 2.1.0 contain a denial of service …7.1
• CVE-2024-5836Inappropriate Implementation in DevTools in Google Chrome pr…8.8